Merge pull request #20401 from zeroSteiner/feat/mod/ldap/gmsa-secrets

Add gMSA Secret Extraction From LDAP

Author: jheysel-r7

lib/metasploit/framework/password_crackers/jtr/formatter.rb

@@ -9,19 +9,29 @@ module Formatter
           # @param cred [credClass] A credential from framework.db
           # @return [String] The hash in jtr format or nil on no match.
           def self.hash_to_jtr(cred)
-            case cred.private.type
-            when 'Metasploit::Credential::NTLMHash'
-              return "#{cred.public.username}:#{cred.id}:#{cred.private.data}:::#{cred.id}"
-            when 'Metasploit::Credential::PostgresMD5'
-              if cred.private.jtr_format =~ /postgres|raw-md5/
+            params_to_jtr(
+              (cred.public.nil? ? '' : cred.public.username),
+              cred.private.data,
+              cred.class.model_name.element.to_sym,
+              format: cred.private.jtr_format,
+              db_id: cred.id
+            )
+          end
+
+          def self.params_to_jtr(username, private_data, private_type, format: nil, db_id: nil)
+            case private_type
+            when :ntlm_hash
+              return "#{username}:#{db_id}:#{private_data}:::#{db_id}"
+            when :postgres_md5
+              if format =~ /postgres|raw-md5/
                 # john --list=subformats | grep 'PostgreSQL MD5'
                 # UserFormat = dynamic_1034  type = dynamic_1034: md5($p.$u) (PostgreSQL MD5)
-                hash_string = cred.private.data
+                hash_string = private_data
                 hash_string.gsub!(/^md5/, '')
-                return "#{cred.public.username}:$dynamic_1034$#{hash_string}:#{cred.id}:"
+                return "#{username}:$dynamic_1034$#{hash_string}:#{db_id}:"
               end
-            when 'Metasploit::Credential::NonreplayableHash'
-              case cred.private.jtr_format
+            when :nonreplayable_hash
+              case format
                 # oracle 11+ password hash descriptions:
                 # this password is stored as a long ascii string with several sections
                 # https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/changes-in-oracle-database-12c-password-hashes/
@@ -40,46 +50,46 @@ def self.hash_to_jtr(cred)
                 # T: = 160 characters
                 #         PBKDF2-based SHA512 hash specific to 12C (12.1.0.2+)
               when /raw-sha1|oracle11/ # oracle 11
-                if cred.private.data =~ /S:([\dA-F]{60})/ # oracle 11
-                  return "#{cred.public.username}:#{Regexp.last_match(1)}:#{cred.id}:"
+                if private_data =~ /S:([\dA-F]{60})/ # oracle 11
+                  return "#{username}:#{Regexp.last_match(1)}:#{db_id}:"
                 end
               when /oracle12c/
-                if cred.private.data =~ /T:([\dA-F]{160})/ # oracle 12c
-                  return "#{cred.public.username}:$oracle12c$#{Regexp.last_match(1).downcase}:#{cred.id}:"
+                if private_data =~ /T:([\dA-F]{160})/ # oracle 12c
+                  return "#{username}:$oracle12c$#{Regexp.last_match(1).downcase}:#{db_id}:"
                 end
               when /dynamic_1506/
-                if cred.private.data =~ /H:([\dA-F]{32})/ # oracle 11
-                  return "#{cred.public.username.upcase}:$dynamic_1506$#{Regexp.last_match(1)}:#{cred.id}:"
+                if private_data =~ /H:([\dA-F]{32})/ # oracle 11
+                  return "#{username.upcase}:$dynamic_1506$#{Regexp.last_match(1)}:#{db_id}:"
                 end
               when /oracle/ # oracle
-                if cred.private.jtr_format.start_with?('des') # 'des,oracle', not oracle11/12c
-                  return "#{cred.public.username}:O$#{cred.public.username}##{cred.private.data}:#{cred.id}:"
+                if format.start_with?('des') # 'des,oracle', not oracle11/12c
+                  return "#{username}:O$#{username}##{private_data}:#{db_id}:"
                 end
               when /md5|des|bsdi|crypt|bf|sha256|sha512|xsha512/
                 # md5(crypt), des(crypt), b(crypt), sha256(crypt), sha512(crypt), xsha512
-                return "#{cred.public.username}:#{cred.private.data}:::::#{cred.id}:"
+                return "#{username}:#{private_data}:::::#{db_id}:"
               when /xsha/
                 # xsha512
-                return "#{cred.public.username}:#{cred.private.data.upcase}:::::#{cred.id}:"
+                return "#{username}:#{private_data.upcase}:::::#{db_id}:"
               when /netntlm/
-                return "#{cred.private.data}::::::#{cred.id}:"
+                return "#{private_data}::::::#{db_id}:"
               when /qnx/
                 # https://moar.so/blog/qnx-password-hash-formats.html
-                hash = cred.private.data.end_with?(':0:0') ? cred.private.data : "#{cred.private.data}:0:0"
-                return "#{cred.public.username}:#{hash}"
+                hash = private_data.end_with?(':0:0') ? private_data : "#{private_data}:0:0"
+                return "#{username}:#{hash}"
               when /Raw-MD5u/
                 # This is just md5(unicode($p)), where $p is the password.
                 # Avira uses to store their passwords, there may be other apps that also use this though.
                 # The trailing : shows an empty salt. This is because hashcat only has one unicode hash
                 # format which is compatible, type 30, but that is listed as md5(utf16le($pass).$salt)
                 # with a sample hash of b31d032cfdcf47a399990a71e43c5d2a:144816. So this just outputs
                 # The hash as *hash*: so that it is both JTR and hashcat compatible
-                return "#{cred.private.data}:"
+                return "#{private_data}:"
               when /vnc/
                 # add a beginning * if one is missing
-                return "$vnc$#{cred.private.data.start_with?('*') ? cred.private.data.upcase : "*#{cred.private.data.upcase}"}"
+                return "$vnc$#{private_data.start_with?('*') ? private_data.upcase : "*#{private_data.upcase}"}"
               when /^(krb5.|timeroast$)/
-                return cred.private.data
+                return private_data
               else
                 # /mysql|mysql-sha1/
                 # /mssql|mssql05|mssql12/
@@ -93,9 +103,10 @@ def self.hash_to_jtr(cred)
                 # /mscash2/
                 # This also handles *other* type credentials which aren't guaranteed to have a public
 
-                return "#{cred.public.nil? ? ' ' : cred.public.username}:#{cred.private.data}:#{cred.id}:"
+                return "#{username}:#{private_data}:#{db_id}:"
               end
             end
+
             nil
           end
 

lib/msf/util/windows_crypto_helpers.rb

@@ -2,6 +2,9 @@ module Msf
 module Util
 module WindowsCryptoHelpers
 
+  EMPTY_LM = "\xaa\xd3\xb4\x35\xb5\x14\x04\xee\xaa\xd3\xb4\x35\xb5\x14\x04\xee".b
+  EMPTY_NT = "\x31\xd6\xcf\xe0\xd1\x6a\xe9\x31\xb7\x3c\x59\xd7\xe0\xc0\x89\xc0".b
+
   #class Error < RuntimeError; end
   #class Unknown < Error; end
 
@@ -200,28 +203,26 @@ def decrypt_user_hash(rid, hboot_key, enc_hash, pass, default)
   def decrypt_user_key(hboot_key, user_v, rid)
     sam_lmpass = "LMPASSWORD\x00"
     sam_ntpass = "NTPASSWORD\x00"
-    sam_empty_lm = ['aad3b435b51404eeaad3b435b51404ee'].pack('H*')
-    sam_empty_nt = ['31d6cfe0d16ae931b73c59d7e0c089c0'].pack('H*')
 
     # TODO: use a proper structure for V data, instead of unpacking directly
     hashlm_off = user_v[0x9c, 4]&.unpack('V')&.first
     hashlm_len = user_v[0xa0, 4]&.unpack('V')&.first
     if hashlm_off && hashlm_len
       hashlm_enc = user_v[hashlm_off + 0xcc, hashlm_len]
-      hashlm = decrypt_user_hash(rid, hboot_key, hashlm_enc, sam_lmpass, sam_empty_lm)
+      hashlm = decrypt_user_hash(rid, hboot_key, hashlm_enc, sam_lmpass, EMPTY_LM)
     else
       elog('decrypt_user_key: Unable to extract LM hash, using empty LM hash instead')
-      hashlm = sam_empty_lm
+      hashlm = EMPTY_LM
     end
 
     hashnt_off = user_v[0xa8, 4]&.unpack('V')&.first
     hashnt_len = user_v[0xac, 4]&.unpack('V')&.first
     if hashnt_off && hashnt_len
       hashnt_enc = user_v[hashnt_off + 0xcc, hashnt_len]
-      hashnt = decrypt_user_hash(rid, hboot_key, hashnt_enc, sam_ntpass, sam_empty_nt)
+      hashnt = decrypt_user_hash(rid, hboot_key, hashnt_enc, sam_ntpass, EMPTY_NT)
     else
       elog('decrypt_user_key: Unable to extract NT hash, using empty NT hash instead')
-      hashnt = sam_empty_nt
+      hashnt = EMPTY_NT
     end
 
     [hashnt, hashlm]